Industrial control equipment vulnerability identification method and system based on double BERT models

Abstract

The invention discloses an industrial control equipment vulnerability identification method and system based on a double-BERT model, and the method comprises the steps: an asset analysis stage: analyzing the flow to generate structured asset data; in the semantic matching stage, a multilingual Sension-BERT model is used for extracting vectors and matching a vulnerability library; in the version identification stage, the BERT is finely adjusted to judge the influence condition of the version; and in the vulnerability confirmation stage, an identification result is manually rechecked. The system comprises an asset processing subsystem and a vulnerability intelligent identification subsystem, and the asset processing subsystem comprises a flow analysis module, an equipment fingerprint identification module, an asset information management module, a scanning task scheduling module and a vulnerability display and screening module. And the vulnerability intelligent identification subsystem comprises a semantic vector matching module, a version matching judgment module and an identification result output module. According to the method, the problems of high asset isomerism, weak semantic matching capability and low version comparison accuracy in the current industrial network can be solved, and the vulnerability identification quality and efficiency are improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of networks, and more particularly to an industrial control device vulnerability identification method and system based on a double-BERT model. BACKGROUND

[0002] With the deepening of national strategies such as the industrial internet and intelligent manufacturing, the functions of industrial control systems (ICS) are gradually improved, and the devices in the industrial environment are gradually becoming complex. SCADA systems, DCS systems, PLC controllers, intelligent terminals, industrial robots and other devices are gradually connected to the industrial environment. The increase in devices means that the security threats faced by the entire industrial control system are also expanding. Each newly added device may introduce different types of vulnerabilities, greatly increasing the difficulty of security operation and maintenance.

[0003] On the one hand, these devices are manufactured by different manufacturers and run different versions of firmware or operating systems, with a life cycle of up to ten or even twenty years, making it extremely difficult to upgrade and maintain. Attackers often exploit these characteristics to exploit high-risk vulnerabilities in old versions to implement penetration, threatening the safe and stable operation of the entire control system. On the other hand, vulnerability attacks have become the main means of industrial network attacks, especially in recent years, advanced persistent threats are based on the precise use of vulnerabilities in specific industrial devices. The vulnerabilities in industrial devices are not only numerous, but also have a large number of "zero-day" risks that have not been disclosed or repaired. The current research on precise identification of industrial device vulnerabilities still needs to be further developed, and the specific reasons are as follows:

[0004] First, the asset identification capability is severely insufficient. The types of devices in the industrial network are diverse, the naming methods are not unified, and the protocols lack standardization, so traditional asset management systems cannot accurately obtain the model, version, running state and other key attributes of the device. Some assets are even "sunk" in the network for years without being known, becoming a "blind area" in security management.

[0005] Second, the vulnerability matching is severely lagging. Although the national vulnerability database (CNVD) and manufacturer security announcements continue to release related patch information, due to the large differences in device model and version number expression methods and the non-uniform naming methods of manufacturers, traditional keyword or regular matching methods often cannot accurately determine whether an asset is affected by a vulnerability. This "inability to accurately match" phenomenon makes it difficult for enterprises to take effective defensive measures in a timely manner, and it is easy to form a serious hidden danger of "unknown known vulnerabilities and unblocked identified vulnerabilities".

[0006] Finally, the vulnerability description usually has problems such as unstructured, non-uniform, language ambiguity, etc. The vulnerability name, affected version, and exploitation method are often described in natural language, which lacks a standard format and is not convenient for system automatic processing. To achieve accurate matching between vulnerabilities and assets, natural language understanding technology must be introduced to analyze the vulnerability description in depth, extract key entities, and construct structured knowledge for processing. SUMMARY

[0007] Therefore, the present application provides an industrial control equipment vulnerability identification method and system based on a double BERT model, which solves the three core problems of asset identification, vulnerability matching and risk understanding by constructing an intelligent sensing mechanism suitable for the characteristics of industrial field environment.

[0008] To achieve the above purpose, the present application provides the following technical scheme: an industrial control equipment vulnerability identification method based on a double BERT model, comprising the following steps:

[0009] In the asset analysis stage, the system receives the communication data flow captured from the industrial network environment, analyzes the manufacturer, product and version information of the device, and generates structured asset data, which is used in the subsequent semantic matching stage to vectorize the manufacturer and product fields, and provides version number information for the version identification stage, and in the vulnerability confirmation stage, it is the core basis for binding vulnerabilities and actual assets;

[0010] In the semantic matching stage, the system uses the text2vec-base-multilingual model trained based on the Sentence-BERT architecture to encode the manufacturer and product fields in the device into semantic vectors, and calculates the similarity with the field vectors in the vulnerability database, and selects the candidate vulnerability entries with similarity greater than the set threshold as high-similarity candidate vulnerabilities;

[0011] In the version identification stage, the version number in the structured asset data and the affected version field in the high-similarity candidate vulnerability obtained in the semantic matching stage form an input pair, which is input into the BERT model fine-tuned by the version training set for binary classification to determine whether the version is within the affected version range of the candidate vulnerability;

[0012] In the vulnerability confirmation stage, the automatically identified vulnerability information is first preliminarily bound to the structured asset data obtained in the asset analysis stage, and then enters the manual screening process, where the user confirms, deletes or supplements the system identification results, eliminates false positives or records that do not meet the conditions, and finally writes the confirmed vulnerability results into the vulnerability database for front-end display and subsequent risk assessment.

[0013] The asset analysis stage analyzes by accepting the communication data flow captured in the industrial network environment. The captured communication flow information includes two different ways, including:

[0014] The offline mode pre-captures communication data and saves the captured data to a file. The system provides an interface to allow users to upload the pre-captured flow file. The flow file is uploaded to the system server through a browser or other management terminal. The flow analysis module receives and analyzes the flow file, identifies the protocol interaction behavior, device communication fingerprint and parameter field, and calls the device fingerprint identification module to extract the manufacturer name, product name, product model, firmware version number, IP address, MAC address and port. After the information is structured, it is stored in the asset information database to generate a standardized asset record.

[0015] The online mode relies on the system to provide real-time flow collection function. By calling the network listening and packet capture function integrated in the system, the specified network port is periodically polled and sampled, and the captured network data is automatically saved to a flow file. The system reads the latest generated flow file according to the set time interval or trigger strategy, and uses a log file or task identifier to record the current packet capture state and progress information. After reading, the communication behavior decoding is completed by the flow analysis module, and then the asset information is extracted by the device fingerprint identification module and written into the database.

[0016] The semantic matching stage includes:

[0017] The system uses the semantic vector matching module to encode the manufacturer name and product name fields obtained in the asset analysis stage into semantic embedding vectors of fixed dimensions using the text2vec-base-multilingual model trained based on the Sentence-BERT framework.

[0018] To improve the context modeling effect of semantic vectors, the system first enhances the semantics of the original fields through natural language templates. The system converts structured fields into natural language sentences using pre-set language templates, activates the context understanding ability of the Sentence-BERT model, and generates embedding vectors with discrimination and semantic distinction.

[0019] Firstly, the structured fields in the CNVD vulnerability database are directly extracted, and the named entity recognition technology is applied to the unstructured text fields in the vulnerability entries to automatically identify the mentioned manufacturer names and product names; all manufacturer and product names are packaged as natural language sentences and uniformly input into the text2vec-base-multilingual model trained under the Sentence-BERT framework for semantic vector coding; the coded vector information is saved as a binary file as a static knowledge embedding vector library, which is loaded during system initialization or batch update for real-time matching task calling;

[0020] The manufacturer and product fields extracted in the asset analysis stage are also enhanced by natural language templates and input into the same semantic model for vector coding and semantic similarity comparison with the vector set in the file; the comparison is performed by FAISS, which still maintains extremely low delay and high matching accuracy when processing millions or even billions of high-dimensional vectors; the approximate nearest neighbor search is performed by FAISS, and the system filters out high-matching-degree vulnerability candidates according to the similarity threshold, obtains the version information of the candidate vulnerabilities, and further confirms the version information in the subsequent version identification stage.

[0021] The version identification stage includes:

[0022] The system extracts the "affected version" field content from the candidate vulnerability records filtered out in the semantic matching stage, and the format of this field is diverse, representing the version range in the form of inequalities; the system converts such inequality expressions into natural language sentences through a rule engine or template mechanism, and constructs "candidate vulnerability sentences" as model inputs;

[0023] Meanwhile, the system packages the device version field identified in the asset analysis stage into a standard natural language sentence to form another input pair for the model; the system inputs each set of "asset version sentence-affected version sentence" into a version matching judgment module constructed based on the BERT architecture and trained by version corpus, which performs semantic-level reasoning and judgment on the input pair, and outputs a binary classification label indicating whether the match is successful and the corresponding probability confidence score.

[0024] The vulnerability confirmation stage includes:

[0025] After completing the version identification, the system outputs the matching relationship between the successful devices and the vulnerability candidates as a to-be-confirmed result item, and submits it to the vulnerability display and screening module for subsequent operation; this module provides human participation capability, allowing system operators to review and eliminate each vulnerability matching record identified; each candidate matching item is provided with a semantic similarity score, a version identification result, and a confidence score to assist human judgment of its accuracy; users can perform item-by-item confirmation operations on the interactive page provided by the system to eliminate false positives.

[0026] The identification system of the industrial control device vulnerability identification method based on the double-BERT model, characterized in that: comprising an asset processing subsystem and a vulnerability intelligent identification subsystem;

[0027] The asset processing subsystem is responsible for receiving, analyzing, managing industrial network communication data and scheduling the key module of the vulnerability identification process, mainly used for building and maintaining the asset information database, and providing manual interaction capability for result screening and confirmation.

[0028] The vulnerability intelligent identification subsystem is an AI model engine part with semantic understanding and semantic reasoning capability in the system, which is specially used for performing intelligent matching and judgment tasks between assets and vulnerability information, and saving the matched vulnerabilities to the database for further processing by the asset processing subsystem.

[0029] The asset processing subsystem comprises:

[0030] The traffic analysis module is used to receive pre-captured communication data files or regularly receive real-time captured communication data, decode and packet process the network communication content, extract the original data stream structure, obtain the traffic information under the current network environment, and obtain the device information of the sending traffic, providing input for subsequent fingerprint identification; This module supports the identification and preliminary cleaning of mainstream industrial control protocols, including Modbus, ENIP;

[0031] The device fingerprint identification module extracts features from the traffic analysis data, identifies the core information fields of the traffic device, including manufacturer, product name, product model, version number, IP / MAC address, and port; Through the pre-stored fingerprint rule library in the system, distance vector matching is performed to output structured asset objects and write them into the asset information table;

[0032] The asset information management module provides persistent management capability for asset data, including asset information addition, query, editing and deletion functions, and supports entering or associating software asset information for each device; Visualize device information, identification rounds, and traffic source information to provide users with a comprehensive asset view;

[0033] The scanning task scheduling module is responsible for task management and scheduling triggered by user operation for vulnerability scanning, including packaging the selected target asset as scanning input by the user, and calling the service interface of the vulnerability intelligent identification subsystem to realize automatic execution of the manufacturer product semantic matching and version judgment process;

[0034] A vulnerability display and screening module is used to display vulnerability identification results, and supports presenting vulnerability records automatically identified by the system to a user, the user can manually screen and eliminate false positives through an interface, and finally confirmed results are written into a vulnerability database, supporting vulnerability details, level classification, search and export operations.

[0035] The vulnerability intelligent identification subsystem comprises:

[0036] A semantic vector matching module converts input manufacturer names and product names into natural language to generate semantic embedding vectors, and then searches for the most similar entries in the CNVD database through a FAISS engine, and outputs candidate vulnerability records.

[0037] A version matching judgment module uses a fine-tuned BERT model to construct an "asset version sentence-vulnerability version description sentence" input pair, and performs binary classification reasoning to determine whether the version falls within the impact range; the module supports natural language understanding of various version formats, inequality expressions and fuzzy version ranges, and outputs matching flags and confidence levels.

[0038] The present application has the following advantages:

[0039] The present application discloses an industrial equipment vulnerability identification method and system based on a double BERT model. The method realizes the automatic identification of device assets in an industrial control environment and the high-precision screening of errors and vulnerabilities through an asset analysis stage, a semantic matching stage, a version identification stage and a vulnerability confirmation stage. In the asset analysis stage, the system captures and analyzes communication data traffic to analyze the manufacturer, product and version of the device and construct a structured asset record. In the semantic matching stage, the system uses a multilingual semantic model based on Sentence-BERT to encode the asset fields and vulnerability library fields in natural language, and searches for vulnerability candidates that match structured and unstructured information in the CNVD through FAISS. In the version identification stage, the system converts the impact version of the candidate vulnerability and the asset version into natural language input pairs, feeds them into a BERT model fine-tuned with version data sets for semantic reasoning, determines whether there is a matching relationship, and outputs the confidence level. In the vulnerability confirmation stage, the system binds high-confidence vulnerabilities automatically identified with assets, provides a manual screening interface, and writes the final results into the database after being confirmed by the user. The method can handle the challenges of version expression diversity, language expression irregularity and semantic fuzzy matching, improve the intelligent level and accuracy of industrial vulnerability identification, reduce the burden of manual screening, significantly enhance the network security situation awareness capability, and solve the problems of current industrial asset vulnerability discovery methods, such as dependence on manual work, low efficiency and high false positive rate. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only a part of the embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of the provided drawings.

[0041] Figure 1 The basic model of the present application is shown in the figure.

[0042] Figure 2 The basic model of the system of the present application is shown in the figure.

[0043] Figure 3 The application deployment embodiment of the present application using offline mode is shown in the figure.

[0044] Figure 4 The application deployment embodiment of the present application using online mode is shown in the figure.

[0045] Figure 5 The semantic vector matching process of the present application is shown in the figure.

[0046] Figure 6 The version matching judgment process of the present application is shown in the figure. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort are also within the protection scope of the present application.

[0048] In the present application, it should be noted that the "industrial asset vulnerability identification system" can be referred to as "identification system" or "the system", which are only different names, but the system structure is completely consistent in function.

[0049] The present application is applicable to an industrial information security system with a centralized control architecture. The so-called centralized architecture refers to that the whole system is divided into two logical parts of asset processing layer and vulnerability identification layer. The asset processing layer can be deployed in the industrial control edge, responsible for accessing, analyzing and modeling asset information of industrial network flow. The vulnerability identification layer can be deployed in the control center, carrying high-performance model reasoning work, having semantic understanding and risk judgment ability, and communicating with each other through HTTP service interface to form a complete intelligent vulnerability identification system.

[0050] The method and system of the present application belong to the category of artificial intelligence assisted industrial safety protection. Unlike traditional rule-based or manual review safety identification methods, the system introduces two trained deep language understanding models: one is a multilingual semantic vector matching model text2vec-base-multilingual trained based on the Sentence-BERT architecture, and the other is a version judgment model based on the fine-tuned version of bert-base-uncased. The former is used to solve the problem of semantic inconsistency, expression difference and language mixture between device manufacturers and product information, and the latter is used to solve the problem of non-standard description of version range, language diversity and format diversity in CNVD vulnerabilities. The two models work together in the system to complete the candidate vulnerability screening and version landing judgment.

[0051] Referring to Figure 1 , a basic model schematic diagram of the present application is shown, the asset analysis stage, the system receives the communication data flow captured in the industrial network environment, analyzes the manufacturer, product and version information of the device, and generates structured asset data; the semantic matching stage, the system uses the text2vec-base-multilingual model trained based on the Sentence-BERT architecture to encode the manufacturer and product fields in the device into semantic vectors after processing, and calculate the similarity with the processed field vector in the pre-extracted vulnerability database, and screen out the candidate vulnerability entries with high similarity; the version recognition stage, the system processes the version number of the asset and the affected version text in the candidate vulnerability description to form an input pair, and inputs it into the BERT model fine-tuned by a large number of version training sets for binary classification judgment, to determine whether the version is within the affected range; the vulnerability confirmation stage, the system first establishes a preliminary binding relationship between the automatically identified vulnerability information and the asset, and then enters the manual screening process, the user confirms, deletes or supplements the system identification result, eliminates false positives or records that do not meet the conditions, and finally writes the confirmed vulnerability result into the vulnerability database for front-end display and subsequent risk assessment.

[0052] Referring to Figure 2, shows a basic model schematic diagram of an industrial control device vulnerability identification method and system based on a double-BERT model, the overall system is divided into two subsystems, an asset processing subsystem and a vulnerability intelligent identification subsystem. The asset processing subsystem is deployed at the edge of the industrial field network, used for accessing, analyzing and managing communication data collected from the industrial network, capturing and analyzing communication data traffic, and identifying the manufacturer, product and version of the industrial device, and generating structured asset data. At the same time, it has the ability to manage asset information, and is responsible for organizing and initiating vulnerability identification tasks, and is the data input and management center of the whole system. The vulnerability intelligent identification subsystem is usually deployed on the central control platform or server with computing power, used to receive structured asset information uploaded from the asset processing subsystem, and perform semantic analysis and version matching tasks. The subsystem has natural language processing capability, and realizes semantic association analysis between device information and information in the vulnerability library, and semantic reasoning judgment between device version and vulnerability impact range, so as to automatically identify possible vulnerabilities and output matching results.

[0053] Referring to Figure 3 , an application deployment embodiment using an offline mode in the application is shown. The following is described:

[0054] First, through the interface provided by the system, upload the pre-captured communication data traffic file in the asset processing subsystem, which can come from the switch port mirror of the industrial field, special packet capture device or other network monitoring tools. After the system receives the file, it starts the identification process, and the traffic analysis module identifies and decodes the traffic data, extracts the industrial protocol message content in the communication process, and continues to operate with the uploaded file in the figure as an example.

[0055] The communication content obtained by analysis will be sent to the fingerprint extraction engine, and the system will identify the key information fields of the device according to the device communication feature matching rules, including manufacturer name, product name, product model, firmware version number, IP address, MAC address, and communication port. According to the uploaded file, the specific information of the assets in the file is shown in Figure 3 .

[0056] Subsequently, the system automatically schedules the vulnerability intelligent identification subsystem for identification. In the semantic matching stage, the manufacturer and product fields in the asset are respectively constructed into natural language sentences, such as Figure 3shown, and semantic vector encoding is performed using a multilingual model trained based on the Sentence-BERT architecture. The vector will be semantically matched with the pre-constructed CNVD vulnerability library vector index (including structured fields and entity word vectors extracted from vulnerability descriptions) through the FAISS engine, from which candidate vulnerability entries with a similarity higher than a set threshold are screened out, and natural language sentences converted from their impact version information are extracted, and the specific content is as shown in Figure 3

[0057] After entering the version identification phase, the system inputs the natural language sentences in the candidate vulnerabilities and the asset version structure into the BERT model fine-tuned by the version corpus to determine whether the asset version falls within the impact range. The model outputs the matching result and the confidence score, and the system retains the candidates with a confidence score higher than a set threshold (such as 0.90) as the identification result.

[0058] Finally, these initially identified vulnerability information will be submitted to the vulnerability display and screening interface for manual review by the user. The system displays the asset information, vulnerability number, semantic similarity, and version judgment confidence of each candidate record in the interface for the user to judge and eliminate false positives one by one. The confirmed vulnerabilities will be officially written into the vulnerability result database, realizing a complete closed loop from offline traffic upload to vulnerability evaluation result display.

[0059] Referring to Figure 4 , an application deployment embodiment schematic diagram using an online mode in the present application is shown. The following is described:

[0060] After the system deployment is completed, the user first sets the packet capture network port and polling time interval through the front-end page, and the packet capture scheduling component built-in the asset processing subsystem starts the timed collection process. The system polls the specified network interface according to the set time period, automatically saves the communication traffic in the current period as a traffic file, and records the corresponding collection task log, including the file name, timestamp, and status. When the newly generated data traffic file is completed, the system automatically triggers the traffic identification process.

[0061] The traffic identification, semantic matching, and version identification stages are the same as in the offline mode. After the matched vulnerabilities are obtained, they cannot be manually screened through the vulnerability display and screening module, but are directly displayed on the front end. In the entire online mode, the system realizes the full-process automation of traffic collection, automatic triggering of analysis and identification, AI model reasoning judgment, and result generation and display, without human intervention, and can continuously discover industrial assets and their possible security risks. It is suitable for real-time monitoring, security auditing, and long-term operation trend analysis of industrial network assets, and realizes high-frequency and high-precision vulnerability perception capability.

[0062] Referring to Figure 5 ​, shows the semantic vector matching flowchart in the application. The following is described:

[0063] The system pre-fetches all vulnerability records in the CNVD vulnerability database, obtains the manufacturer and product name in the structured field, obtains the unstructured text in the vulnerability description, and the system automatically extracts the manufacturer and product entity that may appear in the unstructured text through the named entity recognition (NER) method, and uniformly converts it into a natural language sentence. This construction method can more effectively activate the semantic model to understand the context, thereby generating more discriminative embedding vectors. All converted sentences are encoded into fixed-dimensional semantic vectors by the preloaded text2vec-base-multilingual model, and saved in the local binary file to form a static semantic vector knowledge base.

[0064] The manufacturer and product name are obtained from the asset processing subsystem and converted into natural language in the same way. In the actual matching stage, the system sends the manufacturer and product vectors of the asset to be identified into the FAISS (Facebook AI Similarity Search) engine, and performs efficient approximate nearest neighbor (ANN) search on all field vectors in the vulnerability database. FAISS has the ability to quickly process high-dimensional large-scale vectors and can return several candidate items with the highest similarity within milliseconds. The system further calculates the cosine similarity score of these candidate items and filters out the final candidate vulnerability list according to the set threshold (such as 0.85).

[0065] Each matching result has a semantic similarity score, which is used to measure the closeness of the asset field and the vulnerability field in the semantic space. The candidate vulnerabilities that match successfully will enter the next stage of version matching judgment module to continue to verify whether the affected version range covers the current asset version.

[0066] Referring to Figure 6 , shows the version matching judgment flowchart in the application. The following is described:

[0067] The system first filters out the manufacturers and software that may have vulnerabilities from the semantic vector matching stage, and extracts the version range field that exists in the vulnerability from the combination of the manufacturer and software. This field often exists in the form of unstructured or non-uniform natural language expression in the actual vulnerability database. In order to make these information can be effectively understood by the language model, the system constructs a rule engine + template mechanism to reconstruct the language of the above version range expression, and uniformly converts it into a standard natural language sentence, for example:

[0068] “The CNVD-2023-45256affects versions lower than 2.3.4”

[0069] “The CNVD-2025-71212affects versions greater than or equal to 1.0”

[0070] “The CNVD-2024-68228affects versions 2.x”

[0071] At the same time, the device version field identified from the asset parsing phase is also converted into a natural language sentence, such as:

[0072] “The version is 2.2.5”

[0073] “The device version is 6.1.0.3”

[0074] The system groups these two types of sentences into input pairs and sends them to a deep semantic reasoning model based on the bert-base-uncased architecture. This model has been fine-tuned through a large number of real version sample pairs and has the ability to understand and reason about various version number formats, inequality relationships, and ambiguous expressions in context.

[0075] The model input structure is the standard BERT double sentence input format, and the output is a binary classification label and a corresponding confidence score. The system performs this semantic reasoning judgment process on all candidate vulnerabilities and selects all matching items with a confidence score higher than the set threshold as the current asset that may be affected by the vulnerability.

[0076] The matching successful candidate record is then extracted with its unique vulnerability number and bound with the current device asset to form the final “device-vulnerability” candidate association item, which enters the next phase.

Claims

1. A method for identifying vulnerabilities of industrial control devices based on a double-BERT model, characterized in that, Comprising the following steps: The asset analysis stage receives the communication data flow captured in the industrial network environment, analyzes the manufacturer, product and version information of the device, and generates structured asset data, which is used for vector coding of the manufacturer and product fields in the subsequent semantic matching stage, provides version number information for the version identification stage, and serves as the core basis for binding vulnerabilities and actual assets in the vulnerability confirmation stage; The semantic matching stage uses the text2vec-base-multilingual model trained based on the Sentence-BERT architecture to encode the manufacturer and product fields in the device into semantic vectors, and calculates the similarity between the field vectors in the vulnerability database, filtering out candidate vulnerability entries with a similarity greater than a certain threshold as high-similarity candidate vulnerabilities. In the version identification stage, the version number in the structured asset data and the affected version field in the high-similarity candidate vulnerabilities obtained in the semantic matching stage are combined into an input pair, which is input into the BERT model fine-tuned using the version training set for binary classification to determine whether the version is within the affected version range of the candidate vulnerability. In the vulnerability confirmation stage, the automatically identified vulnerability information is first preliminarily bound to the structured asset data obtained in the asset analysis stage, and then enters the manual screening process, where the user confirms, deletes or supplements the system's recognition results, removes false positives or records that do not meet the conditions, and finally writes the confirmed vulnerability results into the vulnerability database for front-end display and subsequent risk assessment.

2. The industrial control device vulnerability identification method based on a double-BERT model according to claim 1, characterized in that: The asset analysis stage analyzes the captured communication data flow in the industrial network environment, and captures communication flow information in two different ways, including: Offline mode, pre-capture communication data, save the captured data to a file, the system provides an interface to allow users to upload the pre-captured traffic file, the traffic file is uploaded to the system server through the browser or other management terminal, received and analyzed by the traffic analysis module, identify the protocol interaction behavior, device communication fingerprint and parameter field, and call the device fingerprint identification module to extract the manufacturer name, product name, product model, firmware version number, IP address, MAC address and port; After structured processing, the information is stored in the asset information database to generate standardized asset records; Online mode, this model relies on the real-time traffic collection function provided by the system, periodically polls the specified network port by calling the network listening and packet capture function integrated in the system, and automatically saves the captured network data to a traffic file; The system reads the latest generated traffic file at regular intervals or according to the trigger strategy, and uses log files or task identifiers to record the current packet capture state and progress information; After reading, the communication behavior decoding is also completed by the traffic analysis module, and then the asset information is extracted by the device fingerprint identification module and written into the database.

3. The industrial control device vulnerability identification method based on a double-BERT model according to claim 1, characterized in that: the semantic matching stage comprises: The system uses a semantic vector matching module to encode the vendor name and product name fields obtained in the asset analysis stage into semantic embedding vectors, using a text2vec-base-multilingual model trained based on a Sentence-BERT framework. To improve the context modeling effect of the semantic vector, the system first performs semantic enhancement on the original field through a natural language template. First, the structured fields in the CNVD vulnerability database are directly extracted, and the naming entity recognition technology is applied to the unstructured text fields in the vulnerability entries to automatically identify the mentioned vendor names and product names. All vendor and product names are packaged into natural language sentences and uniformly input into the text2vec-base-multilingual model trained under the Sentence-BERT framework for semantic vector encoding. The encoded vector information is saved as a binary file as a static knowledge embedding vector library, which is loaded during system initialization or batch update and called by real-time matching tasks. The vendor and product fields extracted in the asset analysis stage are also enhanced through a natural language template and input into the same semantic model for encoding into vectors. The comparison is performed through FAISS, which maintains extremely low latency and high matching accuracy when processing millions or even billions of high-dimensional vectors. Using FAISS for approximate nearest neighbor search, the system selects high-matching-degree vulnerability candidates based on the similarity threshold, obtains the version information of the candidate vulnerabilities, and further confirms the version in the subsequent version identification stage.

4. The industrial control device vulnerability identification method based on a double-BERT model according to claim 1, characterized in that: the version identification stage comprises: The system extracts the "affected version" field content from the candidate vulnerability records selected in the semantic matching stage. The format of this field is diverse, expressing version ranges in the form of inequalities. The system converts this type of inequality expression into a natural language sentence through a rule engine or template mechanism and constructs a "candidate vulnerability sentence" as a model input. Meanwhile, the system packages the device version field identified in the asset analysis stage into a standard natural language sentence to form another input pair for the model. The system inputs each set of "asset version sentence-affected version sentence" into a version matching judgment module constructed based on the BERT architecture and trained through version corpus set. The module performs semantic-level reasoning on the input pair and outputs a binary classification label indicating whether the versions match and the corresponding probability confidence score.

5. The method according to claim 1, characterized in that: the vulnerability confirmation stage comprises: After completing the version identification, the system outputs the matched successful devices and the vulnerability candidate relationship as a to-be-confirmed result item, and submits it to the vulnerability display and screening module for subsequent operation; the module provides human participation capability, allowing system operators to review and eliminate each identified vulnerability matching record; each candidate matching item is provided with a semantic similarity score, a version identification result and a confidence score to assist human judgment of its accuracy; users can perform item-by-item confirmation operation in the interactive page provided by the system to eliminate false positives.

6. The identification system for the industrial control device vulnerability identification method based on the double-BERT model according to any one of claims 1-5, characterized in that: The system comprises an asset processing subsystem and a vulnerability intelligent identification subsystem. The asset processing subsystem is responsible for receiving, analyzing and managing industrial network communication data and scheduling the key modules of the vulnerability identification process, mainly used for building and maintaining the asset information database, and providing manual interaction capability for result screening and confirmation. The vulnerability intelligent identification subsystem is an AI model engine part with semantic understanding and semantic reasoning capability in the system, which is used to perform intelligent matching and judgment tasks between assets and vulnerability information, and save the matched vulnerabilities to the database for further processing by the asset processing subsystem.

7. The identification system of claim 6, characterized in that: The asset processing subsystem comprises: The traffic analysis module is used to receive pre-captured communication data files or accept real-time captured communication data at regular intervals, decode and packetize the network communication content, extract the original data stream structure, obtain the traffic information in the current network environment, and obtain the device information of the sending traffic, providing input for subsequent fingerprint identification; the module supports identification and preliminary cleaning of mainstream industrial control protocols, including Modbus and ENIP; The device fingerprint identification module extracts features from the traffic analyzed data, identifies the core information fields of the traffic sending device, including manufacturer, product name, product model, version number, IP / MAC address and port; and performs distance vector matching based on the pre-stored fingerprint rule library in the system to output structured asset objects and write them into the asset information table; The asset information management module provides persistent management capability for asset data, including asset information addition, query, editing and deletion functions, and supports entering or associating software asset information for each device; visual presentation of device information, identification rounds and traffic source information provides users with a comprehensive asset view; The scanning task scheduling module is responsible for task management and scheduling triggered by user operation for vulnerability scanning, including packaging the target asset selected by the user as scanning input, and calling the service interface of the vulnerability intelligent identification subsystem to automatically execute the manufacturer product semantic matching and version judgment process; The vulnerability display and screening module is used to display the vulnerability identification results, support presenting the vulnerability records automatically identified by the system to the user, and allow the user to perform manual screening and eliminate false positives through the interface, finally write the confirmed results into the vulnerability database, and support vulnerability details, level classification, search and export operations.

8. The identification system of claim 6, wherein: The vulnerability intelligent identification subsystem comprises: The semantic vector matching module is based on the text2vec-base-multilingual model trained based on the Sentence-BERT structure, converts the input manufacturer name and product name into natural language to generate semantic embedding vectors, and then retrieves the most similar entries recorded in the CNVD database in the vector library through the FAISS engine, and outputs the candidate vulnerability records. The version matching judgment module uses the fine-tuned BERT model to construct an "asset version sentence-vulnerability version description sentence" input pair, and performs binary classification reasoning to determine whether the version falls within the scope of influence. This module supports natural language understanding of various version formats, inequality expressions and fuzzy version ranges, and outputs matching flags and confidence levels.

Images